The k0t campaign is targeting internet-facing FortiGate, FortiWeb and Palo Alto GlobalProtect systems. Attackers are stealing stored credentials, maintaining remote access and, in some cases, moving deeper into compromised networks.
Group-IB and NyxLab disclosed the large-scale activity on 21 October 2026. They identified more than 70,000 exposed credentials and related records across organisations in multiple sectors and regions.
What researchers found in the k0t campaign
The operator, tracked by the researchers as k0t, searches for exposed network edge systems and tests them at scale. Its targets include Fortinet FortiGate firewalls, FortiWeb web application firewalls and Palo Alto Networks GlobalProtect VPN portals.
Initial access is not based on a single security flaw. The k0t campaign combines exploitation of known vulnerabilities with credential reuse, brute forcing and weak passwords. This allows the operator to take advantage of both unpatched software and poorly protected accounts.
After gaining access, the attacker reportedly extracts passwords and other secrets from device configurations. These can include network device credentials and Lightweight Directory Access Protocol (LDAP) records, which may provide access to internal services and user directories.
What the 70,000 figure means
The researchers identified more than 70,000 credentials and related records in data associated with the operation. However, this does not mean that every credential was valid or that every listed organisation suffered a successful compromise.
The volume nevertheless indicates broad targeting rather than attacks against a small number of selected victims. The affected data spans different regions and industries, while the targeted products are widely used to protect remote access and internet-facing services.
How the k0t campaign gains network access
Bulk discovery of exposed systems
The operation reportedly uses public search services to compile lists of internet-facing FortiGate, FortiWeb and GlobalProtect endpoints. These services can identify product banners, open ports and externally accessible administration or VPN interfaces.
Once targets have been collected, the operator can test credentials or known vulnerabilities across many systems. Successful access provides a trusted position at the network perimeter, where devices may store reusable passwords, certificates and connection details.
FortiWeb CVE-2025-64446 exploitation
The FortiWeb element includes exploitation of CVE-2025-64446, a path traversal vulnerability published by Fortinet on 14 November 2025. Crafted HTTP or HTTPS requests can allow an unauthenticated attacker to execute administrative commands, including commands that create new administrator accounts.
Affected releases include FortiWeb 8.0.0 to 8.0.1, 7.6.0 to 7.6.4, 7.4.0 to 7.4.9, 7.2.0 to 7.2.11 and 7.0.0 to 7.0.11. Exploitation in the wild has been confirmed, and proof of concept and attack tooling are available.
FortiGate credential attacks
The FortiGate activity is associated with credential attacks rather than a newly disclosed FortiGate vulnerability. Exposed management and VPN interfaces may be tested using reused passwords, weak credentials or automated brute force attempts.
Fortinet published a situational analysis of the related FortiBleed credential and access campaign on 19 June 2026. Further warnings on 6 and 7 October 2026 said the activity remained active and could result in legitimate administrators being locked out.
This development follows the activity discussed in CyPro’s earlier FortiBleed campaign bulletin. Fortinet has emphasised that FortiBleed describes a credential compromise campaign, not a separate vulnerability or new CVE.
GlobalProtect authentication bypass
The GlobalProtect activity includes abuse consistent with CVE-2026-0257. This PAN-OS authentication bypass affects certain portal or gateway configurations where authentication override cookies are enabled with a specific certificate setup.
In vulnerable configurations, an attacker may obtain VPN access without presenting valid user credentials. Palo Alto Networks disclosed the flaw on 13 May 2026 and updated its advisory on 2 June 2026. Active exploitation has since been confirmed.
Affected branches include PAN-OS 12.1 before the applicable 12.1.4-h6 and 12.1.7 fixes, along with vulnerable PAN-OS 11.2, 11.1 and 10.2 releases before their listed hotfixes. Organisations should consult the vendor advisory for the exact fix applicable to their branch. Panorama and Cloud NGFW are not affected.
Timeline of the k0t campaign disclosures
-
14 November 2025: Fortinet publishes details of FortiWeb CVE-2025-64446, which is subsequently confirmed as exploited in the wild.
-
13 May 2026: Palo Alto Networks discloses GlobalProtect authentication bypass CVE-2026-0257.
-
2 June 2026: Palo Alto Networks updates its advisory with affected releases, fixes and configuration conditions.
-
19 June 2026: Fortinet publishes its analysis of the FortiBleed credential compromise activity affecting FortiGate devices.
-
6 and 7 October 2026: Government and industry warnings report that FortiBleed activity remains active.
-
21 October 2026: Group-IB and NyxLab publicly disclose the k0t campaign. Unit 42 also updates its threat brief to note active exploitation of CVE-2026-0257.
-
22 October 2026: Wider reporting highlights the targeted products and the researchers’ finding of more than 70,000 exposed records.
Persistence, data theft and ransomware links
After initial access, the reported objectives include harvesting configuration secrets, establishing persistence and exfiltrating data. Secondary technical reporting based on the investigation describes OpenConnect-based VPN footholds and the use of legitimate or open source remote management and post-exploitation tools.
Group-IB assesses that k0t may act as an initial access broker, obtaining access before offering it to other criminal operators. Researchers found victim overlap with the Qilin and The Gentlemen ransomware groups, but no direct affiliation has been confirmed.
The specific attribution and 70,000-record figure currently originate from Group-IB and NyxLab. Separate vendor and government advisories confirm exploitation affecting the relevant products, but do not independently confirm the k0t operator cluster.
Why this network edge activity matters
Firewalls and VPN gateways occupy a highly trusted position. Compromise can expose stored credentials, provide persistent remote access and give attackers a route around controls designed to protect internal systems.
UK organisations using these products should not assume that applying a patch alone removes the risk. Credentials taken before remediation may remain usable, while an attacker may already have created accounts or established additional remote access.
Actions for organisations using affected products
-
Identify internet-facing FortiGate, FortiWeb and GlobalProtect services, including management interfaces that should not be publicly accessible.
-
Upgrade affected FortiWeb and PAN-OS systems to vendor-fixed releases, using the exact guidance for the installed software branch.
-
Disable GlobalProtect authentication override cookies where they are not required, and verify the certificate configuration where they remain enabled.
-
Review administrator accounts, configuration changes and unexpected VPN sessions. Check FortiWeb logs for path traversal requests and FortiGate logs for repeated authentication attempts.
-
Obtain current campaign indicators from Group-IB or a threat intelligence provider and compare them with firewall, VPN and endpoint telemetry.
-
Rotate device, LDAP and service credentials stored in affected configurations. Revoke active sessions and investigate internal use of those accounts before restoring access.
Originally reported by cybersecuritynews.com.
